Google Ireland Ltd v Data Protection Commission

• Jurisdiction: Ireland
• Judge: Mr Justice Barr
• Judgment Date: 11 October 2024
• Neutral Citation: [2024] IEHC 577
• Court: High Court
• Docket Number: [Record No. H.JR.2024/81]

Between

Google Ireland Limited

Applicant

and

Data Protection Commission

Respondent

[2024] IEHC 577

[Record No. H.JR.2024/81]

THE HIGH COURT

Data Protection Act - Internet Searches - General Data Protection Regulation - Consumer agencies - Processing of data - Unfair practices

Facts: - Six complaints were lodged by consumer agencies in Norway, Slovenia, Greece, France, Spain and Czechia on behalf of their residents. These complaints regarded the account creation process in all but one of the cases, when opening the account their consent was obtained to process their data. In each case the claimant complained that the process was unfair as it was easier to give consent to the use of their personal data, with one click of the mouse, rather than to choose the option of managing their own account settings, which involved five separate steps and ten individual steps. The claimants further alleged that the language was unfair in that; (i) it was not transparent, (ii) what steps could be taken to alter account settings, (iii) engaged in "dark patterns", where wording used made one option appear appealing and another unappealing.

The respondent made several arguments as to why reliefs sought by the applicant should not be granted in the circumstances of the cases generally, and in particular, in light of the facts that unfolded. They submitted that it was well established in Irish law that they could not challenge the process or the jurisdiction of the body to act in the way they had consented to.

The Judge reached the following conclusions; (i) the privacy of personal data has been recognised in European and Irish Law as deserving of particular protection; (ii) it is essential that account identifier information is provided at the outset; (iii) the applicant is correct in its submission that the account identifier information was essential information; (iv) the Czech complaint does not have an admissible complaint as none of her personal data was processed; (v) the judge rejected the respondents submission on Principle of Mutual Trust and Duty of Sincere Cooperation; (vi) the court rejected that this case fell under the principles in Rowland v An Post [2017] 1 IR 355; (v) it would be futile to make an order striking down the notice of commencement as the respondent would issue a fresh one immediately

There were two further grounds raised in the Amended Statements of Grounds; (i) the applicant has sought a declaration that the respondent has acted ultra vires by the inclusion of complaints that fall outside the temporal scope of the notice of commencement, mainly the French complaint; (ii) there was subsequent evidence that some of the complainants were employees within the consumer agencies which have submitted complaints of behalf of the complainants; there were a number of accounts that were open solely to make complaints in this case

Conclusion - The Court proposed to make the following orders: (a) The court will set aside the notice of commencement dated 23rd October 2023; insofar as it related to the Czech complaint; (b) save as indicated at (a), refuse the relief sought by the applicant in its notice of motion and in its amended statement of grounds. This matter would be listed for 5th November 2024 for making final orders

JUDGMENT ofMr Justice Barrdelivered electronically on the 11 ^th day of October 2024.

Introduction.

1 . The applicant is a multinational company that provides an internet search engine and other facilities to people who have an account with it.

2 . The respondent is the statutory body established pursuant to the Data Protection Act 2018 (hereinafter ‘ DPA 2018’), to, inter alia, handle and if thought appropriate, investigate complaints made by data subjects that the processing of their personal data infringes their rights under the General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter ‘GDPR 2016’) and under DPA 2018.

3 . Essentially, this case concerns six complaints that were lodged by consumer agencies in Norway, Slovenia, Greece, France, Spain and Czechia, on behalf of people resident in those countries.

4 . Each of the complainants made a range of complaints about the process known as the account creation process, which was completed by all but one of the complainants, when opening their account with the applicant; whereby their consent was obtained to the processing by the applicant of their personal data.

5 . In the period September 2022 to March 2023, a total of six complaints were received by the respondent. These complaints had been forwarded by the supervisory authorities in the countries in which the complaints had been originally lodged. These supervisory authorities are known as concerned supervisory authorities, (hereinafter ‘CSAs’). The complaints were forwarded to the respondent as the lead supervisory authority (hereinafter ‘LSA’), due to the fact that the applicant has its registered office in this jurisdiction.

6 . Each of the complaints were in almost identical terms. It is not necessary for the purpose of this application, to examine the content of the complaints in any detail, as this application deals with the admissibility of the complaints, rather than their content.

7 . It will suffice to note that each of the complainants complained that the process leading to the creation of their account, wherein they had to indicate their preference for various account settings, was unfair in that they alleged that it was much easier to give consent to the applicant using their personal data, which could be done by one click on the mouse; rather than choosing the option of managing their own account settings, which required five separate steps and ten individual clicks on the mouse.

8 . It was further alleged that the language used in giving various options to a person when opening an account was unfair in that it (a) was not transparent in relation to what use would be made by the applicant of their personal data; (b) was unclear in relation to what steps could subsequently be taken to alter the account settings; (c) it engaged what are known as “dark patterns”, whereby wording was used that influenced or prompted a person to take a particular option, by making that option appear desirable, while at the same time, making the alternative negative option appear undesirable, as it was described in unfavourable terms. That is but a very brief account of the essence of the complaints lodged on behalf of the six complainants.

9 . After notifying the applicant of receipt of the complaints, and having provided the applicant with the written complaints received by the respondent and following a considerable exchange of correspondence, in the course of which the applicant provided substantial information in relation to its account creation process and in relation to the use to which it puts the information that it gleans from the account holders; the respondent decided on 23 October 2023, to commence an inquiry pursuant to its powers under DPA 2018. It did that by issuing a notice of commencement of inquiry (hereinafter ‘notice of commencement’) on that date.

10 . By letter dated 30 November 2023, the applicant objected to the commencement of the inquiry on the basis that the necessary criteria for admissibility of a complaint had not been met.

11 . In particular, the applicant requested that they be provided with the Google account identifier information in respect of each account, (hereinafter ‘account identification information’). This is essentially the Gmail address of each complainant. The applicant further asked that if the complaint was being lodged by a consumer agency pursuant to the provisions of Art. 80(1) of GDPR 2016, that they be provided with copies of the mandates by which the data subject had authorised the consumer agency to bring the complaint on his or her behalf.

12 . The applicant also requested the evidence which demonstrated that each consumer agency met the requirements to act as a representative body in respect of each complaint. This essentially required evidence that the consumer agency (i) was a not for profit organisation; (ii) had been properly constituted in accordance with the law of the relevant Member State; (iii) had statutory objectives which are in the public interest; and (iv) was active in the field of the protection of data subjects' rights.

13 . By letter dated 22 December 2023, the respondent replied, stating that it disagreed with the assertion that they were obliged to provide a reasoned determination to the applicant in relation to the admissibility of the complaints. It denied that they were obliged to identify, or furnish, any documents which informed the view that had been reached by the respondent that the complaints were admissible. The letter went on to state that, as recorded in the notice of commencement, the respondent had considered the information made available to it in respect of the complaints, to include the content of the complaints themselves, and had satisfied itself that it was appropriate that an inquiry be commenced in order to ascertain whether one or more of the infringements had occurred, or was occurring. The letter further stated that beyond that, issues relating to the validity and/or admissibility of the complaints could and would be dealt with in the context of the decision to be adopted by the respondent in due course. The letter further stated that prior to its adoption, the decision would be circulated to the applicant in draft form and the applicant would be afforded an opportunity to consider and respond to the contents thereof prior to the decision being finalised and adopted.

14 . In this application the applicant...